feat(rust): Add support for cargo-auditable binaries

go.mod

@@ -19,6 +19,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.1 // indirect
+	github.com/microsoft/go-rustaudit v0.0.0-20220805122630-097fff025e34 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect

go.sum

@@ -20,6 +20,8 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/microsoft/go-rustaudit v0.0.0-20220805122630-097fff025e34 h1:W/tuIksfbU5I1xVm2zxi0afcIhDvmnebpdq+tA3OPAE=
+github.com/microsoft/go-rustaudit v0.0.0-20220805122630-097fff025e34/go.mod h1:vYT9HE7WCvL64iVeZylKmCsWKfE+JZ8105iuh2Trk8g=
 github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

pkg/golang/binary/parse_test.go

@@ -96,6 +96,7 @@ func TestParse(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			f, err := os.Open(tt.inputFile)
 			require.NoError(t, err)
+			defer f.Close()
 
 			got, _, err := binary.NewParser().Parse(f)
 			if tt.wantErr != "" {

pkg/rust/binary/parse.go

@@ -0,0 +1,55 @@
+// Detects dependencies from Rust binaries built with https://github.com/rust-secure-code/cargo-auditable
+package binary
+
+import (
+	"golang.org/x/xerrors"
+
+	dio "github.com/aquasecurity/go-dep-parser/pkg/io"
+	"github.com/aquasecurity/go-dep-parser/pkg/types"
+	rustaudit "github.com/microsoft/go-rustaudit"
+)
+
+var (
+	ErrUnrecognizedExe = xerrors.New("unrecognized executable format")
+	ErrNonRustBinary   = xerrors.New("non Rust auditable binary")
+)
+
+// convertError detects rustaudit.ErrUnknownFileFormat and convert to
+// ErrUnrecognizedExe and convert rustaudit.ErrNoRustDepInfo to ErrNonRustBinary
+func convertError(err error) error {
+	if err == rustaudit.ErrUnknownFileFormat {
+		return ErrUnrecognizedExe
+	}
+	if err == rustaudit.ErrNoRustDepInfo {
+		return ErrNonRustBinary
+	}
+
+	return err
+}
+
+type Parser struct{}
+
+func NewParser() types.Parser {
+	return &Parser{}
+}
+
+// Parse scans files to try to report Rust crates and version injected into Rust binaries
+// via https://github.com/rust-secure-code/cargo-auditable
+func (p *Parser) Parse(r dio.ReadSeekerAt) ([]types.Library, []types.Dependency, error) {
+	info, err := rustaudit.GetDependencyInfo(r)
+	if err != nil {
+		return nil, nil, convertError(err)
+	}
+
+	var libs []types.Library
+	for _, dep := range info.Packages {
+		if dep.Kind == rustaudit.Runtime {
+			libs = append(libs, types.Library{
+				Name:    dep.Name,
+				Version: dep.Version,
+			})
+		}
+	}
+
+	return libs, nil, nil
+}

pkg/rust/binary/parse_test.go

@@ -0,0 +1,89 @@
+package binary_test
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/aquasecurity/go-dep-parser/pkg/rust/binary"
+	"github.com/aquasecurity/go-dep-parser/pkg/types"
+)
+
+// Test binaries generated from cargo-auditable test fixture
+// https://github.com/rust-secure-code/cargo-auditable/tree/6b77151/cargo-auditable/tests/fixtures/workspace
+
+func TestParse(t *testing.T) {
+	tests := []struct {
+		name      string
+		inputFile string
+		want      []types.Library
+		wantErr   string
+	}{
+		{
+			name:      "ELF",
+			inputFile: "testdata/test.elf",
+			want: []types.Library{
+				{
+					Name:    "crate_with_features",
+					Version: "0.1.0",
+				},
+				{
+					Name:    "library_crate",
+					Version: "0.1.0",
+				},
+			},
+		},
+		{
+			name:      "PE",
+			inputFile: "testdata/test.exe",
+			want: []types.Library{
+				{
+					Name:    "crate_with_features",
+					Version: "0.1.0",
+				},
+				{
+					Name:    "library_crate",
+					Version: "0.1.0",
+				},
+			},
+		},
+		{
+			name:      "Mach-O",
+			inputFile: "testdata/test.macho",
+			want: []types.Library{
+				{
+					Name:    "crate_with_features",
+					Version: "0.1.0",
+				},
+				{
+					Name:    "library_crate",
+					Version: "0.1.0",
+				},
+			},
+		},
+		{
+			name:      "sad path",
+			inputFile: "testdata/dummy",
+			wantErr:   "unrecognized executable format",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := os.Open(tt.inputFile)
+			require.NoError(t, err)
+			defer f.Close()
+
+			got, _, err := binary.NewParser().Parse(f)
+			if tt.wantErr != "" {
+				require.NotNil(t, err)
+				assert.Contains(t, err.Error(), tt.wantErr)
+				return
+			}
+
+			assert.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

pkg/rust/binary/testdata/dummy

@@ -0,0 +1 @@
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA